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HOW A PIN TUMBLER LOCK WORKS 
© 


The first step to learning how to pick a lock is to understand how it works, and why the components can be exploited in the 
first place. This is something a lot of people don't really take the time to understand properly, because they ther don't think it's 
necessary, or they can't be bothered. | can't stress this enough, pay attention to this section above all else and make sure you 
understand everything 100% before you even think about sticking those picks anywhere. 


SECTION A: THE MECHANISM ITSELF 


The basic pin tumbler lock is pretty simple. I'm not go go into their history or any of the other stuff people like to throw in for 
filler, let's just stick to the facts. Before we begin, please note that technical diagrams are not to scale. All diagrams and 
descriptions are for rim or mortise type cylinders which have pins at the top of the keyway. Euro profile cylinders, which 
typically have pins at the bottom of the keyway, are the same mechanism just in different format. They're picked in the exact 
same way, but to avoid confusion we'll just focus on the one format. 


With that out of the way, a pin tumbler lock consists of some basic main parts which you'll see in the diagram below. The pins 
are at rest, i e. their normal position when no key is inserted: 


Fig. 1: Cylinder at rest. 
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The components you can see are: 


1. Shell (grey) — the main body of the lock, in which the plug sits. 

2. Plug (yellow) — this is where the key goes. There is acam or tailpiece attached to the back of the plug which, when 
rotated, is what actually throws the bolt or retracts the latch and opens the lock. The point where the plug and shell 
separate is called the shear line, and is indicated by a pair of green arrows. 

3. Pin chambers (white) — The series of chambers which are drilled through the shell and into the plug, which is where the 
pins live. Not acomponent as such, but the relation between the pins and their respective chambers is very important. 

4. Key pins (blue) — the pins which come into contact with the key. These are all different lengths and always sit inside the 
plug, below the shear line. Their lengths correspond to the cuts on the key. The deeper the cut, the longer the key pin 
and the less it needs to be lifted in order to shear. 

5. Driver pins (red) — The pins which, in the locked position, block the shear line and prevent the plug from turning. 
Typically these are all identical in length, although higher quality locks generally contain different lengths of drivers. 
This isn't random, they're longer or shorter depending on the length of their corresponding key pin. The purpose of 
which is to make the pin stacks equal lengths, in order to prevent decoding/overlifting attacks. Balanced drivers have no 
effect on picking. 

6. Springs (black) — to keep everything from rattling around like a skeleton interfering with itself. 


SECTION B: HOW THE KEY WORKS 


When we insert the correct key, the pin stacks will be lifted to their correct heights. The split between the key pins 
and drivers rests exactly at the shear line, and the plug is free to rotate. Please excuse the absence of a key in the following 
pictures, the diagrams aren't to scale and it was hard to draw a key without it looking rubbish. 
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So here is the correct key: 


Fig. 2: Correct key inserted. 


And here's an example of an incorrect key. As you can see, the shear line is still blocked because the pin stacks are misaligned: 


Fig. 3: Incorrect key inserted. 
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Even if only one pin is partially blocking the shear line, it's enough to stop the plug from turning. So how does picking work? 
Well, it all boils down to machining tolerances. Read on... 


SECTION C: TOLERANCES AND THE BINDING DEFECT 


As you know, the key aligns all the pin stacks to their correct heights simultaneously. You'd think that without the key, this just 
can't be done and you'd be right. While possible, the chances of doing so would be extremely slim. But we can manipulate the 
pins individually, and this is made possible thanks to tolerances. Even with all our technology, it's physically impossible to 
make all the components exactly the same dimensions and this is what causes the binding defect. 


When we apply a turning pressure to the plug, only one of the pins will be binding against the inside of its chamber. If 
everything was perfectly machined, then all of them would bind simultaneously, and picking with basic hand tools would be 
impossible. But in reality, this just isn't the case. The pin chambers are different diameters, they're not perfectly circular, and 
they're misaligned. The pins are all different as well, not identical in size or shape like you might think. The differences can't be 
seen with the naked eye unless the lock is very poorly made, but these defects are all present in even the highest quality locks, 
and this is what makes picking possible. 


Below is an exaggerated example. To keep the head scratching to a minimum, the pin chambers are all the same size and 


everything is the same shape, chambers are perfectly aligned etc. the only variable here is the diameter of the pins. It's 
nowhere near this simple, but it's the easiest way to explain: 
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Fig. 4: Tolerances exagerrated & simplified. 


In this lock, if we were to apply tension in either direction, pin 2 (looking right to left, where the key enters) would bind first 
because it's the biggest. It's physically impossible for any of the others to bind at this point, anyone can understand this. Pin 2 
is blocking the plug from rotating, but the rest aren't making any contact with their chamber walls whatsoever. We would feel 
pin 2 binding, whereas the others would just spring up and down without any resistance. More on this shortly. 


When we apply tension and lift this pin, once it reaches the shear line, three very important things will happen: 


1. The rotation of the plug will cause the pins to shear. 

The next binding pin will stop the plug from rotating any further. In this case, it will be pin 1 since it's the next largest. 
Most importantly, that slight rotation means the driver we just lifted is now resting on top of the plug. If you can't 
picture what this looks like, here is an exaggerated example: 


w N 
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Fig. 5: Small ledge created by plug rotation. 


The driver stays trapped above the plug, on that little ledge just to the side of the chamber, and the key pin drops back down. 
Now the pin stack in chamber 1 is binding, we lift that stack until the pins shear, and this same process continues until the lock 
opens. In this example, the binding order would be 2-1-5-3-4. And once 4 sets, the plug would rotate freely and open the lock. 
The binding order is completely random by the way, so don't go trying to pick every lock in this specific order. Even in 2 
identical locks with the same key, the binding order will be completely different. 


That covers the principles of binding and how pins stay set, so now you'll be able to understand all that funk you're feeling 
when you start to pick your first lock. Like | said, the tolerances are actually a mixed variety of imperfections working together 
and are much smaller than I've depicted — but generally speaking, the binding pin is pretty easy to identify. Higher quality 
machining means tighter tolerances, which makes it harder to tell (since multiple pins will be binding at once), but you'll still be 
able to tell which is binding more than the others. Don't give this too much thought, it all just comes down to practice and we'll 
be examining this in all its wonderful detail in just a moment. 


| know you're dying to get started, so let's take a quick look at the different pin states and move on. 
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SECTION D: PIN STATES 


Fig. 6: Pin states. 


From left to right: 


A) Atrest — the normal position before any picking takes place. The pins will be pushed down into the keyway and sit on 
top of a ward in the keyway. 


B) Set — driver resting above the plug, key pin inside, shear line clear. 
C) Overset — key pin is lifted too high and blocking plug rotation. We'll talk about this in detail later. 
D) Under set — driver pin still blocking plug rotation. Not lifted high enough. 


E) False set — an under set pin which gives the impression of being set, or has trapped the plug in an exaggerated 
rotation. We'll be examining this later as well. 


OK. Now we can go. 
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PICKING TECHNIQUES 
OO 


SECTION A: THE BASICS... HOW TO HOLD THE TOOLS 


You'd think this is pretty simple, but there are a number of things you should keep in mind if you want to optimise your 
performance. 


When applying tension, only use one finger. You can position the wrench at the top or bottom of the keyway, it does not really 
matter a lot of the time so you can just do whatever is comfortable for you. It's wise to give yourself as much room as possible 
though; having the wrench taking up space in the bottom of the keyway makes it easier to overset pins or get your pick 
trapped. Sometimes the pins bind better with the wrench at the bottom, so if it doesn't cause any trouble, by all means do. See 
example below: 
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The wrenches supplied with pretty much all pick sets are designed more for bottom of keyway tension; a shorter wrench is 
more desirable for top of keyway but not compulsory. | find that if you trim a wrench down to about 8mm it's great for all- 
round use, it gets in good and deep for bottom tension and doesn't stick out so much that is loses grip when up top. The actual 
"handle" can be as long as you please, and can be twisted or not depending on your preference. 


Another thing worth mentioning is that, when using top of keyway, it's good practice to keep the wrench from making contact 
with the front pin so you don't get any confusion with the binding. Most of the time it doesn't really matter if you're making 
light contact with it though. 


As for the pick, again you can do whatever you find comfortable. As long as you have a nice relaxed grip and can move it 
without having to put your wrist into it, you're good to go. Personally | use my thumb and middle finger to grip the handle, just 
before the shaft. | keep my ring finger on the shaft to get maximum feedback. Doesn't matter if the pins are at the top or 
bottom of the keyway. See example below: 
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This way might not be comfortable for you, so experiment and see what you like. Just don't hold it like a knife, or in such a way 
that your wrist is doing all the movement, like in the bottom examples. Remember, you're moving small pins by small amounts. 


All movement should be done with the fingers. 


And that's that covered. 


SECTION B: SINGLE PIN PICKING — THE SPEED BUMP METHOD 


No, this doesn't have anything to do with bump keys. If you want to learn how to bump locks, go to our website. 


Single pin picking is the art of manipulating the pins one by one, by exploiting the tolerances we looked at earlier. | recommend 
you start off with a short hook. And if you skipped straight to this section without getting to grips with the concept of binding 
and how the mechanism actually works, go back to the basics first. 


Ready? Well it's about time. 


This is a method you can use to find the optimal tension for any given lock — which is the most important step, and lays the 
groundwork to get it open with minimal frustration. I'll also give you a complete rundown of what to do and what to feel for. 
I'm not the only person who does it this way, it's not a groundbreaking new technique, | just haven't seen anyone else explain it 
in real detail. 


Just before we start, a word on tension. Everyone says you need barely any pressure on the wrench, which is true, but just 
because a lock will open with the bare minimum, it doesn't mean you have to use that amount. There is actually 

a range of tension you can get away with, so I'll be teaching you how to find that range. That way, you can choose the amount 
you're most comfortable working with. In most cases, you really don't need to go too low. 
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As a beginner, using the absolute minimum, you probably won't have a clue what's going on inside the lock because the 
feedback will be so subtle. That was my experience, anyway. Don't get me wrong, | opened plenty of locks by applying a hair's 
amount of tension and working the pins, but | couldn't tell you the binding order or how high to lift any of the pins to save my 
life. | just felt a set here and there and after a while the lock opened, there was no real consistency. And now that | actually 
have developed the touch for minimal tension, ironically, I've found that it isn't necessary. So this is why we will focus on the 
tension range, and not the lightest touch. 


The technique | use is as follows: 


1. Start with a "medium" amount of tension. When I say that, | don't mean half way between snapping the wrench and 
barely touching it. It's still a light-ish amount, just not light-light. The easiest way to explain this is for you to put a 
standard (non-twistflex) tension wrench into a lock and hold it in your hand. Where your finger would push on the 
wrench, hold it just above one of the keys on your keyboard and push it down. Don't actually tension the lock itself, it's 
just there to keep the wrench from flipping around so you're pushing on the flat part. | want you to see how much it 
takes to just about hold it down and no more. 


Now add a little more on top of that, we'll be using this as your starting point. 


I'm using a standard cheap keyboard so | don't know if this is the best way to explain for everyone — it's not an exact 
science. Remember this isn't the amount you'll be using to actually pick it, very few locks will require anywhere near 
this much. It's just a starting point we'll be working from in order to find the range. 


2. Insert your pick right to the back of the plug, and drag it very slowly back towards you and across the pins. As you do 
this, push the pick gently against the pins so you can feel them springing a little. Don't try to push them as deep as 
they'll go or anything like that, just use very gentle pressure. Think of it like drawing a soft line on a page, just not 
with a pen that's desperately low on ink. You should be able to feel a soft springiness to the pins as it rolls over each 
one. 


UKBumpKeys.com 


What you're looking for is a pin which feels more solid than the others. This is the binding pin, and the reason | call 
this the speed bump method is because when you hit it, it's like the pick has hit a little bump. A lot of people push each 
pin individually to find which one is binding, which you can do if you want. As long as you find it, that's the main 

thing. 


The more tension you apply, the more obvious the binding pin will be, but | wouldn't recommend using anything 
heavier than what I described before. Honestly, the binding pin will stick out like a sore thumb under that amount so 
there's really no need to start any higher. 


If you can't feel anything binding under that amount of tension, and assuming you're not being dense and 

pushing against the warding, it's usually because the binding pin is the one right at the back. Since it's the first pin 
you're in contact with, it just feels like part of the back of the lock, so if you can't feel any binding, don't jump the 

gun and start piling on more tension. Carefully get onto the back pin and see if it gives any resistance when you push on 
it. | guarantee if you can't feel any binding, it'll be the pin at the back you need to be focusing on. If you're having a hard 
time feeling the back pin, roll gently from front to back over the pins instead until you get onto it. 


If it's definitely not the back pin, then you can try more tension. Some locks do take a fair amount. Anyway, when you've 
identified the first binding pin, move onto step 3. 


Position the very tip of the pick on the middle of the pin which is binding. You might find it helpful to roll the pick back 
and forth over it a little to get the position just right. You don't need to be exactly in the middle of the pin, but it's good 
practice. Next you want to apply some pressure to the pin. Think about the amount it takes to push a non- binding pin 
all the way down and use that. 


Slowly start to reduce the amount of tension you're applying to the plug. The pin will start to move under the pres- sure 
of the pick at some point, so try your best to hold the pick pressure steady and concentrate on the tension rather than 
pushing harder on the pin to get it to move. You're already using quite a bit of pick pressure here, so concentrate on the 
tension until you feel the pin start to move alittle. 


UKBumpKeys.com 


When you do feel it this, you can hold the tension there for picking if you want, although this is more to set a bound- 
ary so you know how much is too much. You can push the pins into place from here without too much force, but there'll 
be a fair bit of drag as the pins move. At this point you're using max tension for that lock, and whereas you're not at a 
ridiculous level, it's still more than necessary. 


From here it's quite easy to find a balance between the pick pressure and tension. Just play around, making sure not to 
go over max. You want the pins to move easily, but at the same time you also want to feel the binding slightly as they 
move. It takes a while to really get the feel for what I'm talking about, but when you figure this out you'll be working 
with the best of both worlds — great feedback, and without the grunt. 


BEFORE CONTINUING, PLEASE NOTE: 

When pushing any pin into place, you should aim to keep the pick shaft from interfering with the other pin stacks as much as possible. Don't hold the 
pick parallel to the cylinder as you're moving a pin into place, use a sort of levering action to ensure minimal contact with the other pins (i.e. the tip 
goes up and the shaft stays as far down out of the way as possible). 


Also, make sure to attack the pins from an angle rather than trying to get straight under them and levering upwards. It's not as easy to do it this way 
at first, but the reason we do all this is to help avoid oversetting. We'll be looking at this properly in the next section. 


As you push the binding pin, when it comes to shear, you'll feel it set one way or another and you can then move onto 
the next binding pin. Once you've set that first pin, you can hold the tension at the same amount, or increase slightly as 
you set each one if necessary. You might want to increase tension to find the next binding pin although you can hold it 
steady, doesn't really matter. 


How clear the sets feel depends on the lock. Some you'll feel a very distinct click, both in the pick and wrench, and 
you'll hear a nice click as well. In many locks, mostly older ones, the feedback is very dull and sometimes practically 
non-existent. You can feel the binding just fine, but as you actually push the pins into place, there's only avery dull click 
as each pin sets or they'll just come to a stop with no real indication of being set other than they've stopped moving. 
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You'd think that older would mean more worn, thus looser tolerances and nicer feedback — which is true, but when a 
lock is in use for a long period a time there's a fair amount of dirt which builds up in there and it really kills those nice 
clicks you're looking for. Most of the time it doesn't cause any problems as long as you keep a mental note of the 
binding order. 


This all sounds like a very complex process, which I guess it is, but it's actually pretty simple when you get the hang of it. 
Of course it'll take a lot of practice to get the feel for things properly, but after a while it'll be second nature and you'll 
do it without thinking. You can get onto the first binding pin, set it, and have the tension figured out in a matter of 
seconds and from there it can be very easy, or rage-inducing, depending on the lock you're up against. 


SECTION C: OVERSETTING 


Oversetting can be the simple result of carelessness, or a genuine problem caused by staggered pin configurations and/or 
crazy security pins. At times, it can be completely unavoidable, so | wan it in some detail. Here you'll learn how to keep it from 
happening, and fix it when it does. 


First and foremost, pushing too hard on a set pin will cause some (or all) of the other set pins to drop back down to their rest 
positions. With most average locks you can push set pins a little over the shear line and get away with it since they just fall 
back into place, but if you push too far then you're in trouble. Mostly though, as long as you don't intentionally try to force an 
already set pin, it's fine. 


This is easy to avoid. Just be careful with the pick, and keep a mental note of which pins you've set. If you are ever in doubt 


about a pin, leave it alone and check the others first. If you've figured out the tension and a pin isn't moving under normal pick 
pressure, never try to force it. Simple as that. 
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It really is a massive help to keep at least a loose mental note of any pins you've set. Trust me, it's not hard to do, and you'll be 
especially glad you learned the habit when it comes to the higher quality locks. If you map out what the lock is doing, even 
roughly, it means that even if the majority of pins reset on you, you're able to get back to the same point again quickly to 
analyse what happened. 


In addition to using too much force, you might overset pins with the pick shaft. Providing you're using the correct technique as 
described in the previous section, this can only really happen if you have pins which are considerably deeper setting than ones 
in front of them. There are actually two ways this can occur, and depends on the binding order. 


In the diagram below, using a short hook you can see that by lifting pin 4 to its correct height, the shaft is pushing pin 
2 too high. Ignore the other pins, we're just going to focus on those two and what happens depending on the order they bind. 


Fig. 7: Example of oversetting. 


If pin 2 was the first pin to bind, it wouldn't be a big problem so we'll look at that first. We would set pin 2, then feel 4 binding. 
Pin 2 is very long and we now have to reach under it. So with this pick, we wouldn't be able to push pin 4 deep enough to 
actually set it because pin 2 would be pushed up by the pick shaft. 
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Cases like this are simple enough. Out comes a bigger hook to reach under pin 2 and set 4 deeper. In this instance, you'd only 
overset pin 2 if you accidentally tried to force pin 4 with a short hook. This would result in an overset pin 2, pin 4 wouldn't set, 
and you'd probably reset other set pins (if there were any) in the process. You'd be pretty screwed, so don't do it. Simple rule, 
never try to force anything. If it doesn't want to go, the first thing you should dois grab a pick with deeper reach and scoop 
under the ones which are in the way. 


Like | said earlier, not all locks give nice crisp feedback, and some people worry about oversetting in these cases. 
Understandable, but trust me, you'd still figure it out. In this example, if you pushed pin 4 as far as you could without 
disturbing 2, you wouldn't feel any other pins binding so you'd know that pin 4 needed to be set deeper. 


Fig. 7: Example of oversetting. 


Now let's look at what happens if 4 was the first to bind. This is a problem because, as you can see, 2 is above the shear line 
when pin 4 sets. I'm sure you can tell what happens — at the moment the plug shears pin 4, it rotates and binds pin 2 while it's 
above the shear line. It will stay stuck there, and you wouldn't actually be aware of this at first, since when you go over pin 2 it 
will just feel like a normal binding pin. Same sort of idea as before, it won't set no matter how far you push it — and since 
nothing else is binding, you'll know something is up with it. 
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This time though, instead of not being able to push it far enough, you'd find you could push it all the way without it setting — 
which tells you it's already gone past set and you're going the wrong way. As I'm sure you can imagine, it's not always this 
simple in practice, but that's the theory anyway. 


If you identify a pin as overset, you need to reverse pick it back to the shear line. Sometimes multiple pins can overset, which is 
more complicated, but the general idea is to feel how many are binding when they shouldn't be and reverse pick until you hear 
that number of clicks. By now you should see why having a good mental map really comes in handy. Even if you know exactly 
which pins are overset, | can tell you it is always easier said than done. 


The general principle of reverse picking is to drop the tension very carefully, with a sort of pulsing motion, to catch the drivers 
on their way down. That's all there is to it, this is more practice than specific technique. Can be very tricky depending on the 
tolerances of the lock, but it's doable. 


When I explain this to people, a common question is, why don't we just use a deep reach pick all the time and cut out all this 
nonsense? Well, the reason is that it's not always as easy (or possible) to use longer hooks in tighter keyways — and there's no 
point making things harder on yourself without good reason. Most locks don't have crazy bittings, so it makes sense to go with 
the most user friendly pick until the lock starts giving you problems. Honestly, you can pick the vast majority of locks with the 
basic short hook. However if you do need more picks. You know where to come. 


Let's recap: 
e Go easy onthe pins at all times. 
e Take mental notes as you go along. 
e Always attack the pins from an angle, and keep the pick shaft as much out of the way of the other pins as possible. 
e Don't try to achieve the impossible. If a pin won't set, make an educated guess as to why, and choose a more suitable 


pick. Or, in the case of oversetting, use reverse picking to correct the overset pin(s). 


If all else fails, try picking in the opposite direction. Some locks will open relatively easily one way, and be downright 
impossible the other. 
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One last piece of advice, remember the 3 P's — Practice, Patience and Persistence. Without all 3, you'll only level out at 
pretty basic stuff — and even then, it'll still be half luck. But Good luck! 


Remember to Practice! 


Thanks for reading, 


Mike Gibson 


Edited by C. Dangerfield for UKBumpKeys.com 
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